|
| 1 | +package WeBWorK::PG::SafeGD; |
| 2 | + |
| 3 | +=head1 NAME |
| 4 | +
|
| 5 | +WeBWorK::PG::SafeGD - Restrict GD::Image new method file path arguments to |
| 6 | +permitted_read_dir. |
| 7 | +
|
| 8 | +=head1 DESCRIPTION |
| 9 | +
|
| 10 | +GD is shared into the safe compartment for graphing macros (via WWPlot and the |
| 11 | +PGgraphmacros.pl macro). Several of the GD::Image methods take a file path |
| 12 | +argument and open it directly, with no restriction (C<new>, C<newFromPng>, |
| 13 | +C<newFromJpeg>, C<newFromGif>, C<newFromTiff>, C<newFromXbm>, C<newFromWebp>, |
| 14 | +C<newFromHeif>, C<newFromWBMP>, C<newFromBmp>, C<newFromGd>, C<newFromGd2>, |
| 15 | +C<newFromGd2Part>, and C<newFromXpm>). The C<restrict> method in this package |
| 16 | +ensures that if those methods are called on an unsafe path (a path not in the |
| 17 | +C<permitted_read_dir>), the methods do not reveal anything about the existence |
| 18 | +or lack thereof for the file path argument. The C<WWPlot> package does not use |
| 19 | +these path-taking forms (only the numeric-size constructor is used). |
| 20 | +
|
| 21 | +C<restrict> patches the GD::Image symbol table in place, so it only needs to run |
| 22 | +once per process, after GD itself has been loaded. |
| 23 | +
|
| 24 | +=cut |
| 25 | + |
| 26 | +use strict; |
| 27 | +use warnings; |
| 28 | + |
| 29 | +use WeBWorK::PG::IO; |
| 30 | + |
| 31 | +my $patched = 0; |
| 32 | + |
| 33 | +# Only reject arguments that look like they're meant to be a path (a plain string, not an |
| 34 | +# already-open filehandle/IO object) and that GD would otherwise try to open unrestricted. |
| 35 | +sub _unsafe_path { |
| 36 | + my $path = shift; |
| 37 | + return 0 if ref $path; |
| 38 | + return 0 unless defined $path && length $path; |
| 39 | + return !WeBWorK::PG::IO::path_is_subdir($path, $WeBWorK::PG::IO::pg_envir->{directories}{permitted_read_dir}); |
| 40 | +} |
| 41 | + |
| 42 | +sub restrict { |
| 43 | + return if $patched || !GD::Image->can('_make_filehandle'); |
| 44 | + $patched = 1; |
| 45 | + |
| 46 | + no warnings qw(redefine prototype); |
| 47 | + |
| 48 | + # Every newFrom* method implemented in GD/Image.pm other than the XS methods (Png, Jpeg, Gif, Tiff, Xbm, Webp, Heif, |
| 49 | + # WBMP, and Bmp) call _make_filehandle. The new method does as well, but is wrapped separately below, since it |
| 50 | + # touches the filesystem before calling this. |
| 51 | + my $orig_make_filehandle = \&GD::Image::_make_filehandle; |
| 52 | + *GD::Image::_make_filehandle = sub { |
| 53 | + die "GD: refusing to open \"$_[1]\" as it is not in an allowed location.\n" if _unsafe_path($_[1]); |
| 54 | + goto &$orig_make_filehandle; |
| 55 | + }; |
| 56 | + |
| 57 | + # The single argument form of new executes -f tests on the given file path argument before it calls |
| 58 | + # _make_filehandle. Skip the check only when the argument is recognized as raw image data rather than a path at all, |
| 59 | + # since then no file access happens anywhere. Otherwise $! is set for non-existent files, and so this can be used |
| 60 | + # for a file existence test in a problem. |
| 61 | + my $orig_new = \&GD::Image::new; |
| 62 | + *GD::Image::new = sub { |
| 63 | + die "GD: refusing to open \"$_[1]\" as it is not in an allowed location.\n" |
| 64 | + if @_ == 2 && !ref $_[1] && !GD::Image::_image_type($_[1]) && _unsafe_path($_[1]); |
| 65 | + goto &$orig_new; |
| 66 | + }; |
| 67 | + |
| 68 | + # These are implemented in XS and take a file path directly, bypassing _make_filehandle. |
| 69 | + no strict 'refs'; |
| 70 | + for my $method (qw(newFromGd newFromGd2 newFromGd2Part newFromXpm)) { |
| 71 | + next unless GD::Image->can($method); |
| 72 | + my $orig = \&{"GD::Image::$method"}; |
| 73 | + *{"GD::Image::$method"} = sub { |
| 74 | + die "GD: refusing to open \"$_[1]\" as it is not in an allowed location.\n" if _unsafe_path($_[1]); |
| 75 | + goto &$orig; |
| 76 | + }; |
| 77 | + } |
| 78 | + use strict 'refs'; |
| 79 | + |
| 80 | + # stringFT's font file argument is only restricted when it looks like an absolute path, since it may legitimately be |
| 81 | + # a relative name or fontconfig pattern (e.g. after useFontConfig) instead of a path. |
| 82 | + if (GD::Image->can('stringFT')) { |
| 83 | + my $orig_string_ft = \&GD::Image::stringFT; |
| 84 | + *GD::Image::stringFT = sub { |
| 85 | + die "GD: refusing to open \"$_[2]\" as it is not in an allowed location.\n" |
| 86 | + if defined $_[2] && !ref $_[2] && $_[2] =~ m{^/} && _unsafe_path($_[2]); |
| 87 | + goto &$orig_string_ft; |
| 88 | + }; |
| 89 | + # stringTTF is a plain alias for stringFT set up when GD::Image was loaded, so it still points |
| 90 | + # to the original, unwrapped sub unless it is re-aliased here. |
| 91 | + *GD::Image::stringTTF = \&GD::Image::stringFT; |
| 92 | + } |
| 93 | + |
| 94 | + use warnings qw(redefine prototype); |
| 95 | + |
| 96 | + return; |
| 97 | +} |
| 98 | + |
| 99 | +1; |
0 commit comments